IETF Logo Mail Archive

Re: [Dots] draft-ietf-dots-signal-channel-33

"MeiLing Chen" <chenmeiling@chinamobile.com> Thu, 16 May 2019 02:27 UTC

Return-Path: <chenmeiling@chinamobile.com>
X-Original-To: dots@ietfa.amsl.com
Delivered-To: dots@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6EE1D120091 for <dots@ietfa.amsl.com>; Wed, 15 May 2019 19:27:55 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.589
X-Spam-Level:
X-Spam-Status: No, score=-2.589 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, T_KAM_HTML_FONT_INVALID=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 31tOLMptMxJJ for <dots@ietfa.amsl.com>; Wed, 15 May 2019 19:27:50 -0700 (PDT)
Received: from cmccmta2.chinamobile.com (cmccmta2.chinamobile.com [221.176.66.80]) by ietfa.amsl.com (Postfix) with ESMTP id 83284120041 for <dots@ietf.org>; Wed, 15 May 2019 19:27:48 -0700 (PDT)
Received: from spf.mail.chinamobile.com (unknown[172.16.121.19]) by rmmx-syy-dmz-app05-12005 (RichMail) with SMTP id 2ee55cdccaa1d9b-c5e7c; Thu, 16 May 2019 10:27:45 +0800 (CST)
X-RM-TRANSID: 2ee55cdccaa1d9b-c5e7c
X-RM-TagInfo: emlType=0
X-RM-SPAM-FLAG: 00000000
Received: from cmcc-PC (unknown[10.2.51.72]) by rmsmtp-syy-appsvr10-12010 (RichMail) with SMTP id 2eea5cdccaa0449-64b06; Thu, 16 May 2019 10:27:45 +0800 (CST)
X-RM-TRANSID: 2eea5cdccaa0449-64b06
Date: Thu, 16 May 2019 10:27:46 +0800
From: MeiLing Chen <chenmeiling@chinamobile.com>
To: "Konda, Tirumaleswar Reddy" <TirumaleswarReddy_Konda@McAfee.com>, "mohamed.boucadair" <mohamed.boucadair@orange.com>
Cc: dots <dots@ietf.org>
References: <2019051517083625930510@chinamobile.com>, <BYAPR16MB27906A258DCA4A2B8E5B9C88EA090@BYAPR16MB2790.namprd16.prod.outlook.com>
X-Priority: 3
X-Has-Attach: no
X-Mailer: Foxmail 7.2.9.115[cn]
Mime-Version: 1.0
Message-ID: <201905161027457150788@chinamobile.com>
Content-Type: multipart/alternative; boundary="----=_001_NextPart623475456726_=----"
Archived-At: <https://mailarchive.ietf.org/arch/msg/dots/Dlml8ppK6abF6b88GUQcXkdvvPY>
Subject: Re: [Dots] draft-ietf-dots-signal-channel-33
X-BeenThere: dots@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "List for discussion of DDoS Open Threat Signaling \(DOTS\) technology and directions." <dots.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dots>, <mailto:dots-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dots/>
List-Post: <mailto:dots@ietf.org>
List-Help: <mailto:dots-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dots>, <mailto:dots-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 16 May 2019 02:27:55 -0000

Hi Tiru,

DDoS Detector by scrubbing the traffic identifies the target and protocols used to attack the victim (e.g. if it is slowloris attack, the protocol number will be TCP (and in future UDP with QUIC)). 
 [Meiling] "target-protocol" is contained in the mitigation request as an optional parameter, when dots client first send mitigation request to dots server, It just  warning of a suspected attack, the attack have not been scrubbed. what is "DDoS Detector" ? and Is it capable of detect and disposal ddos attack?

 
From: MeiLing Chen <chenmeiling@chinamobile.com> 
Sent: Wednesday, May 15, 2019 2:39 PM
To: Konda, Tirumaleswar Reddy <TirumaleswarReddy_Konda@McAfee.com>; mohamed.boucadair <mohamed.boucadair@orange.com>
Cc: dots@ietf.org
Subject: draft-ietf-dots-signal-channel-33
 
CAUTION: External email. Do not click links or open attachments unless you recognize the sender and know the content is safe.


Hi Tiru, Med;I read draft-ietf-dots-signal-channel-33, I have a question about the parameter of target-protocol,
 
target-protocol:  A list of protocols involved in an attack.  Values      are taken from the IANA protocol registry [proto_numbers].      If 'target-protocol' is not specified, then the request applies to      any protocol.
question:  how can attack-target detect the protocols involved in an attack?

v2.23.0 | Report a Bug | By Email